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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 03 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )E3 Responsive to communication(s) filed on 18 December 2000 . 
2a)D This action is FINAL. 2b)|3 This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) [3 Claim(s) 1-20 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) I3 Claim(s) 1-20 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10) S The drawing(s) filed on 20 January 2004 is/are: a)IE accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

11) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 1 9(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2.D Certified copies of the priority documents have been received in Application No. . 



3.D Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
See the attached detailed Office action for a list of the certified copies not received. 
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Claims 1-20 have been examined. 



Double Patenting 



The nonstatutory double patenting rejection is based on a judicially created 
doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the 
unjustified or improper timewise extension of the "right to exclude" granted by a patent 
and to prevent possible harassment by multiple assignees. See In re Goodman, 1 1 
F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 
USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 
1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970);and, In re Thorington, 
418 F.2d 528, 163 USPQ 644 (CCPA 1969). 

A timely filed terminal disclaimer in compliance with 37 CFR 1 .321(c) may be 
used to overcome an actual or provisional rejection based on a nonstatutory double 
patenting ground provided the conflicting application or patent is shown to be commonly 
owned with this application. See 37 CFR 1.130(b). 

Effective January 1, 1994, a registered attorney or agent of record may sign a 
terminal disclaimer. A terminal disclaimer signed by the assignee must fully comply with 
37 CFR 3.73(b). 

Claims 1-20 are rejected under the judicially created doctrine of obviousness- 
type double patenting as being unpatentable over claims 1-20 of U.S. Patent No. 
6,622,150. Although the conflicting claims are not identical, they are not patentably 
distinct from each other because in both inventions a system and method for efficiently 
managing computer virus definitions using a structured virus database are disclosed. 
Both inventions provide a system and method for sharing computer virus definition data 
in a backward compatible manner using a structured virus database. 



The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 



Claim Rejections - 35 USC§ 103 
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Claims 1-20 are rejected under 35 U.S.C. 103(a) as being unpatentable over 

Nachenberg (US Patent No. 6,357,008) and further in view of Serbinis et al. (US Patent 

1 . As per claims 1,10 and 20, Nachenberg disclose a system for distributing 
portable computer virus definition records with binary file conversion, comprising: 
-a structured virus database storing one or more virus definition records, (col 1 , lines 
27-33) each virus definition record comprising: 
-an identifier uniquely identifying a computer virus; (col 1, lines 27-33) 
-at least one virus name associated with the computer virus; (col 2, lines 43-44, Unlike 
virus signatures, these sequences are not designed to be specific to a single virus. 
Instead, they are meant to be as general as possible in order to detect the operation of 
many different viruses. 

-a virus definition sentence comprising object code providing operations to detect the 
identified computer virus within a computer system; (col 1, lines 39-41, detected using 
signature scanning) and 

-a virus removal sentence comprising object code providing operations to clean the 
identified computer virus from the computer system; (col 1 , lines 39-41 , a signature 
scanning antivirus program can identify particular virus strains for removal and may 
have a low "false-positive" rate if properly implemented, 
-instructions to clean the computer virus from the computer system; and names 
associated with the computer virus, (a signature scanning antivirus program can identify 
particular virus strains for removal and may have a low "false-positive" rate if properly 
implemented, col 1, lines 39-41) 

Nachenburg et al. do not teach a client database engine storing at least one updated 
virus definition record into the structured virus database indexed by the identifier and 
the at least one virus name for each virus definition record. However, Serbinis et al. 
teach a database engine (col 6, lines 27-53) and the at least one name for each 
definition record (Fig.3, and col 8, lines 12-62, group of objects must be clustered into a 



Application/Control Number: 09/740,617 Page 4 

Art Unit: 2143 

definition record with a name, similarly a class of virus can be grouped for executable 
file, boot record, com. Etc.) 

Nachenburg et al. do not teach a converter converting the virus definition records stored 
in the structured virus database into a virus data file comprising virus definition sets, 
each virus definition set comprising binary data encoding instructions to detect the 
computer virus within a computer system. However, Serbinis et al. teach the document 
may be automatically compressed or encrypted, or at the Originator's request, 
converted to a particular file format suitable for the Authorized Users (e.g., converted 
from WordPerfect.RTM. to Microsoft Word). Other forms of filtering may include 
formatting, translating or virus checking. Both the storage and filtering step, if 
performed, are logged to the appropriate tables in DMS database, col 10, lines 51-61 ) 
Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was made to have modified Nachenberg et al. with the teachings of 
Serbinis et al. to include a data base engine accessing the virus definition records in the 
structured virus database indexed y the identifier and at least one name for each virus 
definition record because logical collections can be stored at the same time and 
relationship maintained, col 8, lines 54-57) 

2. As per claim 2, Nachenberg disclose a system further comprising: 
-a client anti-virus language decompiler converting each virus definition set 

in the virus data file into a virus definition record, (an anti-virus language compiler is 
implied as unknown viruses are mapped to code that appears virus like, col 2, lines 18- 
25) and (col 1, lines 39-45) 

3. As per claim 3, Nachenberg disclose a system further comprising a server 
database engine comparing subsequently modified versions of the structured virus 
database to form a delta set of virus definition records; (col 7, lines 25-27) and 
the client database engine storing the delta virus definition records set into 

the structured virus database, (col 1, lines 27-33) 

4. As per claim 4, Nachenberg disclose a system further comprising: 



Application/Control Number: 09/740,617 Page 5 

Art Unit: 2143 

a server database engine building the virus definition records into the structured virus 
database by generating the identifier for each virus definition record and populating 
each virus definition record with the virus definition sentence and the virus removal 
sentence for the computer virus, col 1, lines 39-45) 

5. As per claim 5, Nachenberg disclose a system further comprising a server 
anti-virus language decompiler converting each virus definition set in the virus data file 
into a virus definition record, (col 2, lines 18-25) 

6. As per claim 6, Nachenberg disclose a system further comprising: 

-the database engine accessing the virus definition records in the structured virus 
database (col 1 , lines 27-38) to perform at least one of adding, removing, and replacing 
a virus definition record, (updated database, col 1, lines 44-45) 

7. As per claim 7, Nachenberg does not teach a compression module compressing 
the structured virus database prior to transfer and a decompression module 
decompressing the structured virus database subsequent to transfer. However, Serbinis 
et al. teach a compression module compressing the structured virus database prior to 
transfer (col 11, lines 66-67 and col 12, lines 1-7) and a decompression module 
decompressing the structured virus database subsequent to transfer (col 13, lines 46- 
49). Therefore, it would have been obvious to a person having ordinary skill in the art at 
the time the invention was made to have modified Nachenberg et al. with the teachings 
of Serbinis et al. to include a compression module compressing the structured virus 
database prior to transfer and a decompression module decompressing the structured 
virus database subsequent to transfer because it allows documents to be filtered during 
the retrieval, Serbinis et al. col 13, lines 46-49). 

8. As per claim 8, Nachenberg does not teach an encryption module encrypting the 
structured virus database prior to transfer; and a decryption module decrypting the 
structured virus database subsequent to transfer. Serbinis et al. teach an encryption 
module encrypting the structured virus database prior to transfer; (col 11, lines 66-67 
and col 12, lines 1-7) and a decryption module decrypting the structured virus database 
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subsequent to transferred 13, lines 46-49). Therefore, it would have been obvious to a 
person having ordinary skill in the art at the time the invention was made to have 
modified Nachenberg et al. with the teachings of Serbinis et al. to include an encryption 
module encrypting the structured virus database prior to transfer; and a decryption 
module decrypting the structured virus database subsequent to transfer because it 
allows documents to be filtered during the retrieval, Serbinis et al. col 13, lines 46-49). 



9. As per claim 9, Nachenberg does not teach a system wherein the structured 
virus database is a relational database. However, Serbinis et al. teach wherein the 
structured virus database is a relational database, (col 6, lines 27-53). Therefore, it 
would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified Nachenberg et al. with the teachings of Serbinis 
et al. wherein the structured virus database is a relational database because it allows 
documents to be filtered during the retrieval process then entries may include a storage 
type, a storage path (i.e. index), a name, a maximum size and a state value (Serbinis et 
al., col 6, lines 27-53) 

10. Claims 11-18 recite the same limitations as claims 2-9. Therefore, they are 
analyzed and rejected by the same rationale. 

11. As per claim 19, Nachenberg does not teach a computer-readable storage 
medium holding code, (col 3, lines 10-67) 
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Conclusion 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Mitra Kianersi whose telephone number is (703) 305- 
4650. The examiner can normally be reached on 7:00AM-4:00PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, David Wiley can be reached on (703) 308-5221 . The fax phone number for 
the organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 

Mitra Kianersi 
May/06/2004 



Dp0 WILEY 
SUPERVISORY PATENT EXAMINER 
TECHNOLOGY CENTE; I ■■: 




